The most important points in 60 seconds / tl;dr
- The EU Data Act has applied since 12 September 2025. It does not cover every file and does not automatically cover every SaaS application.
- Users of connected products and related services can request readily available raw and pre-processed data with the metadata needed to use it, generally free of charge and in a machine-readable format.
- Data can be shared with third parties under the regulation. Data protection, trade secrets and security requirements remain limits.
- Providers of data processing services must facilitate switching and interoperability. From 12 January 2027 they may not impose switching charges; until then, reduced cost-based charges may apply.
- For an SME, a documented export with schema, dependencies, access and an import test matters more than a generic contract sentence saying “your data belongs to you”.
Sources: EUR-Lex: Regulation (EU) 2023/2854, Data Act · European Commission: Data Act explained
01
The Data Act is not a data vault for everything
The Data Act aims to make data more accessible and the European data economy fairer. In practice, two topics meet: users of connected products should be able to obtain and use data generated through their use more easily. Customers of data processing services should be able to switch providers or use several services in parallel without unnecessary lock-in.
That sounds like a general right to all data. It is not. Scope depends on the product, service, data type and role. Derived analysis, third-party content, trade secrets and security risks can be treated differently.
Timing
The regulation has applied since 12 September 2025. Its switching-charge rules also include a transition period until 12 January 2027.
02
Which products and data count?
For an SME, the first question is not “Do we have data?” but “Which data is generated by which product or service, and can the data holder retrieve it without disproportionate effort?”
Connected product
An item that generates or collects usage or environmental data and can make it available electronically, physically or on the device. Examples include machinery, vehicles, sensors and smart devices.
Related service
A digital service, including software, connected to a product that enables, extends, updates or adapts one or more of its functions.
Readily available data
Product and related-service data that the data holder lawfully has or can obtain through a simple operation without disproportionate effort.
Data processing service
A scalable, on-demand pool of computing resources such as infrastructure, storage, platforms, software or applications. The Data Act’s switching rules apply to these services.
Not every SaaS product is automatically Chapter II
A purely internal or web-based tool is not a connected product merely because it is software. Cloud and data processing services may still be relevant to the switching and interoperability chapter. The exact classification depends on the facts.
03
Data access: raw data, metadata, not every finished analysis
The access rules target data generated by using a connected product or related service that is readily available to the data holder. The Data Act expressly refers to raw data, pre-processed data and the metadata needed to interpret them.
Inform before the contract
Type, format, estimated volume, real-time capability, storage location and expected retention should be described clearly.
Request simply
When direct access from the product or service is unavailable, a simple electronic request should be enough where technically feasible.
Deliver usable data
Where the regulation applies, data should be secure, free, complete, structured, commonly used and machine-readable.
Do not forget metadata
A CSV export without units, time basis, field definitions or device context can exist formally and still be unusable.
Example: smart meter
Measurements such as consumption, timestamp and device status may be relevant raw or pre-processed product data. A forecast derived by a provider’s own models is not automatically the same data type and is not automatically accessible.
05
Switching cloud services: the exit must work technically
For data processing services such as cloud and edge offerings, the Data Act sets minimum conditions for switching and interoperability. A customer should be able to port data and exportable digital assets to another provider or its own infrastructure.
1. Check the contract first
The contract must describe switching, assistance, continuity, exportable data, exemptions and timelines clearly.
2. Use exports and interfaces
Providers must give information about formats, data structures and available interfaces.
3. Plan the transition
The mandatory transition period should generally be no more than 30 calendar days. Technical infeasibility must be explained within 14 working days; an alternative period may not exceed seven months.
4. Retrieve the data
After the transition, a retrieval period of at least 30 days is provided. Transfer should be secure and avoid unnecessary interruption.
5. Understand equivalence
Functional equivalence concerns comparable features of the same service type, not identical internal technology or every detail of the old platform.
Switching charges
Until 12 January 2027, reduced switching charges may be imposed when they are directly connected to the specific switch. From 12 January 2027, providers may not impose switching charges. Regular service prices, agreed early-termination costs and additional migration services explicitly requested by the customer are different categories.
06
A contract is not an exit strategy
A contract can promise portability and still fail on unclear formats, missing keys or manual dependencies. An SME should describe and test export like a technical process.
Data inventory
Which tables, objects, files, events, metadata and digital assets are exportable?
Format and schema
Are formats, units, relationships, versions and character encoding documented?
Access and secrets
How are accounts, keys, certificates, configuration and permissions rebuilt securely?
Dependencies
Which DNS records, webhooks, jobs, devices, apps and third parties must be changed?
Import test
Can a representative dataset be imported into a target environment and accepted by the business?
Deletion and evidence
How is deletion of exportable data at the old provider confirmed after a successful switch?
Illustrative export package
A useful package may contain data, schema, checksums and a short import guide, for example:
export/
customers.csv
events.ndjson
schema.json
checksums.txt
README.md
The filenames are only a pattern. The important parts are clear semantics, secure transfer and a successfully tested import.
07
What the Data Act does not promise automatically
A reliable guide names the limits as clearly as the new rights. Otherwise data access becomes a false expectation for both providers and customers.
No right to every analysis result
Derived, inferred or highly enriched data and third-party content are not automatically covered in the same way as raw and pre-processed product data.
No right to source code or internal models
Internal implementation, protected digital assets and trade secrets do not simply have to be disclosed.
No free pass around personal data
Data protection rules remain applicable. Sharing personal data must be lawful and controlled.
No automatic one-click migration
The provider must facilitate switching. Data models, target platforms, integrations and business acceptance remain a real migration project.
Custom services can be treated differently
For heavily customised data processing services that are not broadly offered commercially, some switching obligations are limited.
The safe wording
“Exportable” should never be just a marketing word in a contract. Define scope, format, deadline, access, security requirements and a test case.
08
The 10-point SME checklist
These questions help sort an existing product or cloud contract technically before getting lost in legal keywords.
- Connected products, related services and data processing services are inventoried separately.
- For every product, data types, formats, volume, frequency and retention are known.
- Raw, pre-processed, metadata and derived data are distinguished.
- The roles of user, data holder and possible third parties are documented.
- There is a direct access path or a simple electronic request path.
- Export formats, schema, units and relevant interfaces are described.
- Configuration, secrets, devices and integrations are part of the exit plan.
- Switching charges, transition period and retrieval window are in the contract and understood.
- A representative export was imported into a target environment and accepted by the business.
- Data protection, trade secrets, security and deletion evidence have an assigned owner.
09
Frequently asked questions
Does the Data Act cover every business application?
No. The data access rules focus particularly on connected products and related services. Cloud and data processing services have separate switching rules. A purely internal tool is not automatically fully covered just because it is software.
Must the cloud provider perform the entire migration for free?
No. Switching charges disappear from 12 January 2027, but additional migration services explicitly requested by the customer may be agreed separately. Regular service prices and some contract costs are different categories.
Can a provider withhold data because of trade secrets?
The Data Act does not require disclosure of protected internal technology or trade secrets. Exemptions must not unnecessarily prevent or delay the intended switch.
What matters before 12 January 2027?
Check the contract, export scope and costs, define a format and test an import. The transition period for charges is not a reason to postpone exit planning until 2027.
What should a small business do first?
Start with one concrete product or cloud service: create a data inventory, request an export, document the schema, add dependencies and run a small migration test.
10
Official sources and the regulation
Primary sources used for this article, last checked on 18 August 2026.